               (format "A user does not have  %s permission" action)))))
     (testing "A user can be granted permissions on attachment in someone else's entities"
       (grants/create storage-spec {:user-id (:id jane)
-                                   :entity-id (:entity-id attachment)
+                                   :entity-id (:entity-id transaction)
                                    :permissions {:attachment #{:show}}})
       (with-authentication jane
         (doseq [action [:show]]

(use-fixtures :each (partial reset-db storage-spec))

(def ^:private attachments-context
  {:users [(factory :user, {:email "john@doe.com"})]
   :entities [{:name "Personal"}]
   :commodities [{:name "US Dollar"
                  :symbol "USD"

(deftest attachment-management
  (let [context (serialization/realize storage-spec attachments-context)
        [john jane] (find-users context "john@doe.com" "jane@doe.com")
        attachment (find-attachment context "receipt")
        transaction (transactions/find-by-id storage-spec
                                             (:transaction-id attachment))]
    (testing "A user has permissions on attachment in his own entities"
      (with-authentication john
        (doseq [action [:show :edit :update :delete]]
